2

Is it possible in IIS7, without using URL Scan to remove the Server in the response header? I have tried the following:

HttpModule

I've installed a signed one into the GAC and also tried the App_Code directory and neither has worked. I've also tried setting the

HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\DisableServerHeader 

registry entry to 1 and still nothing.

EDIT: I've also tried this: Community ISAPI filter

Is there any possible way to do this?

3

1 Answer 1

1

I've tried adding the following to my application-level "Web.Config" file with varying degrees of success:

  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="ETag" />
        <remove name="Server" />
        <remove name="X-AspNet-Version" />
        <remove name="X-AspNetMvc-Version" />
        <remove name="X-Powered-By" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>

This only applies to content served out of the application directory (and subdirectories) and doesn't work when applied to the "applicationHost.config" file underneath the "System32/inetsrv/config" directory. I've also had this change not work at all (how I came across your question here while researching this issue), so your mileage may vary.

1
  • Doesn't remove the Server header
    – jjxtra
    May 18, 2012 at 16:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .